diff --git a/build_num b/build_num index ac182eafd..b783782d3 100644 --- a/build_num +++ b/build_num @@ -1 +1 @@ -#define BUILD_NUM 1623 +#define BUILD_NUM 1624 diff --git a/doc/ChangeLog b/doc/ChangeLog index a54a77fa1..b814985c8 100644 --- a/doc/ChangeLog +++ b/doc/ChangeLog @@ -1,7 +1,9 @@ 2009-10-20 vadim * NATCompiler_pf_writers.cpp (PrintRule::processNext): Added - support for branching NAT rules for PF. + support for branching NAT rules for PF. Compiler generates + keyword "anchor" if PF version is 4.3 or later and "nat-anchor" + and "rdr-anchor" for earlier versions. * platforms.cpp (getActionNameForPlatform): Human-readable names for Policy and NAT rule actions come from the platform .xml diff --git a/src/gui/platforms.cpp b/src/gui/platforms.cpp index 5b2eff4f9..74a53c68c 100644 --- a/src/gui/platforms.cpp +++ b/src/gui/platforms.cpp @@ -403,7 +403,8 @@ void getVersionsForPlatform(const QString &platform, std::list &res res.push_back(QStringPair("","- any -")); res.push_back(QStringPair("3.x", QObject::tr("3.x"))); res.push_back(QStringPair("ge_3.7", QObject::tr("3.7 to 3.9"))); - res.push_back(QStringPair("4.x", QObject::tr("4.x"))); + res.push_back(QStringPair("4.0", QObject::tr("4.0 to 4.2"))); + res.push_back(QStringPair("4.3", QObject::tr("4.3 and later"))); /* add pf versions here */ } else { diff --git a/src/pflib/CompilerDriver_pf.cpp b/src/pflib/CompilerDriver_pf.cpp index ef745db2f..60e39ee79 100644 --- a/src/pflib/CompilerDriver_pf.cpp +++ b/src/pflib/CompilerDriver_pf.cpp @@ -246,7 +246,8 @@ void CompilerDriver_pf::printStaticOptions(QTextStream &file, Firewall* fw) // and generate 'set skip on ' commands if (fw->getStr("version")=="ge_3.7" || - fw->getStr("version")=="4.x") +// fw->getStr("version")=="4.x") + XMLTools::version_compare(fw->getStr("version"), "4.0")>=0) { for (list::iterator i=all_interfaces.begin(); i!=all_interfaces.end(); ++i) diff --git a/src/pflib/CompilerDriver_pf_run.cpp b/src/pflib/CompilerDriver_pf_run.cpp index 2f4826d61..3bc54cb2a 100644 --- a/src/pflib/CompilerDriver_pf_run.cpp +++ b/src/pflib/CompilerDriver_pf_run.cpp @@ -181,7 +181,9 @@ QString CompilerDriver_pf::assembleFwScript(Firewall* fw, bool cluster_member, O if (fw->getStr("platform") == "pf") { script_skeleton.setVariable("pf_flush_states", options->getBool("pf_flush_states")); - script_skeleton.setVariable("pf_version_ge_4_x", fw->getStr("version")=="4.x"); + script_skeleton.setVariable("pf_version_ge_4_x", // fw->getStr("version")=="4.x"); + XMLTools::version_compare(fw->getStr("version"), "4.0")>=0); + } else { script_skeleton.setVariable("pf_flush_states", 0); @@ -331,6 +333,17 @@ string CompilerDriver_pf::run(const std::string &cluster_id, if (!nat->matchingAddressFamily(policy_af)) continue; string ruleset_name = nat->getName(); + + if (ruleset_name.find("/*")!=string::npos) + { + QString err("The name of the policy ruleset %1" + " ends with '/*', assuming it is externally" + " controlled and skipping it."); + warning(fw, nat, NULL, + err.arg(ruleset_name.c_str()).toStdString()); + continue; + } + if (nat->isTop()) ruleset_name = "__main__"; diff --git a/src/pflib/NATCompiler_pf.h b/src/pflib/NATCompiler_pf.h index 5c50cadff..373a6dc13 100644 --- a/src/pflib/NATCompiler_pf.h +++ b/src/pflib/NATCompiler_pf.h @@ -348,7 +348,12 @@ namespace fwcompiler { */ class PrintRule : public NATRuleProcessor { - protected: + void _printAnchorRule(const std::string &anchor_command, + const std::string &ruleset_name, + const std::string &interface_name, + libfwbuilder::NATRule *rule); + + protected: bool init; std::string current_rule_label; diff --git a/src/pflib/NATCompiler_pf_writers.cpp b/src/pflib/NATCompiler_pf_writers.cpp index 3183ef1a5..ee54488a6 100644 --- a/src/pflib/NATCompiler_pf_writers.cpp +++ b/src/pflib/NATCompiler_pf_writers.cpp @@ -81,6 +81,8 @@ bool NATCompiler_pf::PrintRule::processNext() tmp_queue.push_back(rule); + string version = compiler->fw->getStr("version"); + if (!compiler->inSingleRuleCompileMode()) { string rl=rule->getLabel(); @@ -246,19 +248,16 @@ bool NATCompiler_pf::PrintRule::processNext() // in test mode compiler->abort() does not really abort the program ruleset_name = "UNKNOWN"; } - compiler->output << "anchor \"" << ruleset_name << "\" "; - if (iface_name!="") compiler->output << "on " << iface_name << " "; - if (!osrv->isAny() || !osrcrel->isAny() || !odstrel->isAny()) + if (XMLTools::version_compare(version, "4.2")>=0) { - _printProtocol(osrv); - compiler->output << "from "; - _printREAddr( osrcrel ); - compiler->output << "to "; - _printREAddr( odstrel ); - _printPort(osrv, true); + _printAnchorRule("anchor", ruleset_name, iface_name, rule); + } else + { + _printAnchorRule("nat-anchor", ruleset_name, iface_name, rule); + _printAnchorRule("rdr-anchor", ruleset_name, iface_name, rule); } - compiler->output << endl; + } break; @@ -268,6 +267,30 @@ bool NATCompiler_pf::PrintRule::processNext() return true; } +void NATCompiler_pf::PrintRule::_printAnchorRule(const string &anchor_command, + const std::string &ruleset_name, + const std::string &interface_name, + NATRule *rule) +{ + RuleElementOSrc *osrcrel = rule->getOSrc(); + RuleElementODst *odstrel = rule->getODst(); + RuleElementOSrv *osrvrel = rule->getOSrv(); + Service *osrv = compiler->getFirstOSrv(rule); + + compiler->output << anchor_command << " \"" << ruleset_name << "\" "; + if (interface_name!="") compiler->output << "on " << interface_name << " "; + if (!osrvrel->isAny() || !osrcrel->isAny() || !odstrel->isAny()) + { + _printProtocol(osrv); + compiler->output << "from "; + _printREAddr( osrcrel ); + compiler->output << "to "; + _printREAddr( odstrel ); + _printPort(osrv, true); + } + compiler->output << endl; +} + void NATCompiler_pf::PrintRule::_printProtocol(Service *srv) { // CustomService returns protocol name starting with v3.0.4 diff --git a/src/pflib/PolicyCompiler_pf_writers.cpp b/src/pflib/PolicyCompiler_pf_writers.cpp index 8a74e026c..cc64b637f 100644 --- a/src/pflib/PolicyCompiler_pf_writers.cpp +++ b/src/pflib/PolicyCompiler_pf_writers.cpp @@ -44,6 +44,7 @@ #include "fwbuilder/IPv4.h" #include "fwbuilder/DNSName.h" #include "fwbuilder/AddressTable.h" +#include "fwbuilder/XMLTools.h" #include #if __GNUC__ > 3 || \ @@ -945,7 +946,8 @@ bool PolicyCompiler_pf::PrintRule::processNext() { // tcp service, no special flag match - if ( version == "4.x") +// if ( version == "4.x") + if (XMLTools::version_compare(version, "4.0")>=0) { if (compiler->getCachedFwOpt()->getBool( "accept_new_tcp_with_no_syn") ) @@ -1005,7 +1007,8 @@ bool PolicyCompiler_pf::PrintRule::processNext() * interface. Adding rule option "Set 'keep state' * explicitly" to cope with this. */ - if ( version != "4.x" || + if (XMLTools::version_compare(version, "4.0") < 0 || + //if ( version != "4.x" || compiler->getCachedFwOpt()->getBool("pf_keep_state")) compiler->output << "keep state "; } @@ -1093,7 +1096,8 @@ bool PolicyCompiler_pf::PrintRule::processNext() } else { // stateless rule - if ( version == "4.x") + if (XMLTools::version_compare(version, "4.0")>=0) + //if ( version == "4.x") // v4.x, stateless rule compiler->output << "no state "; } diff --git a/test/pf/objects-for-regression-tests.fwb b/test/pf/objects-for-regression-tests.fwb index a5c24c588..130865c04 100644 --- a/test/pf/objects-for-regression-tests.fwb +++ b/test/pf/objects-for-regression-tests.fwb @@ -1,6 +1,6 @@ - + @@ -1096,11 +1096,7 @@ - - - - @@ -16128,7 +16124,7 @@ - + @@ -16151,12 +16147,12 @@ - + - + @@ -16286,6 +16282,7 @@ + @@ -16353,6 +16350,280 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +